SMTP Relay for O365 mailbox

[vikpaw]

Trying to setup external SMTP relay with Microsoft 365 to allow high send rate. 
 

Looking at services like SendGrid, MailGun etc. but struggling with the fact they all use basic auth and Microsoft is actively blocking this.
 

Ideally want to set this up so a handful of users can be given access to the Comms / Marketing email and do a mail shot to 15k+ recipients.
 

Avoiding them using the SMTP service’s UI so they don’t need to upload and maintain 15k+ contacts. Unless someone knows of an automated integration the can sync the global directory.

 

Outlook client doesn’t allow manually editing SMTP when you’re using cloud exchange. Mail on a Mac was the same. 
 

IMAP doesn’t work as Microsoft don’t really support it well. Even if we put in bypasses and policies to try and make it work we’re getting auth failure during validation so can’t set the account up. 
 

Same issues with PC and Mac clients, otherwise could set up manual SMTP.

 

Tried building a Mail Connector but that too fails to authenticate as it doesn’t validate the SMTP service because they don’t allow you to enter credentials even for outbound connections. So the service just responds with a 550 error. Ignoring the failed validation, can push messages out but the SMTP servers reject any attempt as unauthorised. 
 

Ideally need an SMTP relay that supports modern authentication.

 

Failing that a way to sync the Exchange address list into the Contacts section in the SMTP system would make life way easier. Low code options require the contacts to by in the mailboxes My Contacts for sync. It won’t look at the directory. 

 

Looked at low code integrators that could possibly take an inbound email and forward it on to SendGrid but that would only work with a fixed recipient list and we want to use dynamic subgroups so triggering from an inbox event isn’t ideal. 
 

Otherwise it’ll have to be an app that we create which will get very messy and require a UI and it quickly becomes complex. 
 

You’d think this would be a common problem that’s solved for big enterprises already.
 

Currently got a hack in place using HubSpot marketing tools but needs manual upkeep of the contacts which is a nightmare.  
 

Any ideas welcome. 

[MatthewL]

Setup your connector them point your devices at your-0365-id-co-uk.mail.protection.outlook.com or create a CNAME for it and it should work thats what we have done.  Still white site IP's in your connector.

[vikpaw]

But is that going through Microsoft smtp?

 

My issue isn’t devices it’s real users wanted to mass email so we’re trying to use an external SMTP service. 
 

When we configure the connector to route to a partner it doesn’t accept credentials. Which leads to the Unauthorised error. 
 

Trying to find a partner that works in this way for routing is a challenge or we’re using the wrong search terms. 
 

[HPlum78]

It's sounds like a CRM... Dynamics 365 can be used to do this, also I thought that SendGrid supported oAuth so just need an app registration. Authenticated SMTP is not the only way to skin this cat as SendGrid (as most others do) support DKIM/ SPF as well. 

 

How to Set Up SPF and DKIM for SendGrid - DMARCLY

[vikpaw]

It supports it via API methods I think. 
Not sure how to get an app to pick up all sent mail , it gets fiddly. 
 

Dynamics is an option but it’s ugly and we wanted something simple for our users. 
 

Can it be hooked up as the outbound route on Outlook or would we need to use the UI just benefit from the contacts being in sync? 

[chaplic]

Microsoft has Azure Communication Services (ACS) which does just that, and it makes use of the Office 365 SPF ranges.  And can do basic auth

 

It has some rather interesting oddities to it, but does the job (if you happen to be in Glasgow, I’m speaking about it in a few weeks!)

[vikpaw]

4 hours ago, chaplic said:

Microsoft has Azure Communication Services (ACS) which does just that, and it makes use of the Office 365 SPF ranges.  And can do basic auth

 

It has some rather interesting oddities to it, but does the job (if you happen to be in Glasgow, I’m speaking about it in a few weeks!)

Tell me more, and will the talk be recorded. Unlikely to make it to glasgow.

 

A few posts have mentioned ACS, but it still seems to be getting the wrong end of the stick. The issue is we want a user to go to their outlook, select two distribution lists (large number of recipients) and hit send. It should be routed out via our chosen SMTP relay (because Microsoft don't support bulk / high volumes).

 

I can see we can build apps, and using code send mail out via the apps, or use Graph etc. Maybe i'm missing something.

 

Is there a worked example out there somewhere....

[psydii]

On-prem Exchange? If your public IP(s) are not already blacklisted ....

 

You'd need an on-prem mailbox and a custom transport connector for the purpose  and would need to make use of an alternative Outlook Profile for the senders. That special on-prem account/mailbox could be given send-as their daily-(cloud)-account.

 

The on-prem server would be configured to send all email not aimed at onmicrosoft.com addresses directly, you'd need to have a firewall/NAT egress rule for smtp traffic from the server to appear from a specific public IP, which would need all the relevant DNS records, and be configured to require at least TLS 1.2.

 

There'd be a chance you'd get your IP blacklisted, but with all DMARC, SPF and  all latest security and identity standard on the mx host/dns records you might get away with it.

 

Of course Exchange 2025 is missing in action and New Outlook doesn't work with Exchange 2022, so you'd need the old Win32 Outlook to remain available to pull this off.

Edited March 20, 2025 by psydii

[chaplic]

plumbing wise this is what to do :

 

 

A service principal would be created in the same azure sub as ACS with the rights
 

Microsoft.Communication/EmailServices/Write

Microsfoft.CommunicationServices/Read

Microsoft.Communication/CommunicationServices/Write

 

In O365 Id have a connector triggered by a transport rule.  The connector would ship mail to smtp.azurecomm.net.

 

The username is ACSName.ApplicationID.TenantID and the password the secret key, relevant to the  service principal and ACS instance above

 

From there,  we just need a transport rule to determine what to send down the connector

 

However, re-reading your requirement this is complete bobbins as it will still count these as outgoing messages.

 

 

Emails to accepted domains are not counted. So you could have  @list.myorg.com as an accepted domain but sent to internal relay, then a route to Exchange on prem where the DLs are held (and not synced to Office365). This would have a similar connector (not transport rule generated) to send to ACS. Then in O365 you have  contact object representing the  DL on prem. Wrap around it some controls so that unauthorised users cant use it. It's a pretty crappy solution...

 

 

 

 

 

 

[vikpaw]

Not on prem. All in the cloud, which is why it's harder.

 

The challenge is which smtp relay we use. and if its via a connector, they don't support basic auth. It mentions a smart host could/would work, but wants to challenge via a test email. 

 

Currently trying out SMTP2Go who purport to accept relay based on mailbox From email address and an IP whitelist. But i think the connector is interceding as the From and it's not going through.

[Arthur]

23 hours ago, vikpaw said:

Trying to setup external SMTP relay with Microsoft 365 to allow high send rate.

 

Would Microsoft's High Volume Email service work for your use case?

 

https://admin.cloud.microsoft/exchange#/highvolumeemail

 

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/high-volume-mails-m365

 

Quote

 

Public preview limitations and known issues:

• Up to 100k recipients per 24 hrs.
• Up to 20 HVE accounts.
• Up to 50 recipients per message.
• HVE accounts are different kinds of mail user accounts. Please avoid giving any license to HVE accounts.

 

[vikpaw]

Looked at HVE and it’s only in preview and still quite limited and throttled.

its also designed for internal email and external is limited to 2000 I think. 
 

The bulk of our user base are in schools who all use their own domains. So class as external. 
 

Managed to get a few to route out to Gmail via SMTP2Go thru kindly gave me a limited trial to do a PoC. But some Microsoft filters on our end and at one of the test schools are blocking the routing and sending back a soft bounce so trying to work out what’s going wrong there. 
 

Something is impersonating the outbound account as the bounce message is being sent out via the SMTP relay and allowed back in but the original email is blocked. 🙄

[Steve21]

8 hours ago, vikpaw said:

Managed to get a few to route out to Gmail via SMTP2Go thru kindly gave me a limited trial to do a PoC. But some Microsoft filters on our end and at one of the test schools are blocking the routing and sending back a soft bounce so trying to work out what’s going wrong there. 

I assume you've setup all the equivalent DKIM/DMARC/SPF records on SMTP2GO as per your main tenant? If not SMTP2GO defaults to adding it's own DKIM records which would then likely clash as it's showing different domains it's sending/receiving from

Steve

[vikpaw]

Yep, DNS entries are in as they requested and validated.

They don't ask for SPF anymore, but gonna try and whitelist a bunch of domains and IPs however we can.

 

EDIT: on second check, SPF is not a requirement as it's covered by using a bespoke subdomain as the return address.

 

Quote

SPF is automatically taken care of by us when you verify your domain on the "Sending > Verified Senders > Sender domains" section of your account. To verify your domain, we provide you with three CNAME records to add to the domain's DNS settings. SPF is covered by the first CNAME record which is the subdomain used for the return-path address we set on your behalf.

Note: You do not need to update your domain's existing SPF record. We moved away from that requirement in 2019 once switching over to VERP and details regarding that can be found in this blog article.

Will look into VERP a bit more.

Edited March 21, 2025 by vikpaw
amendment